Search papers, labs, and topics across Lattice.
This paper introduces Fasco, a lightweight confidential container runtime leveraging ARM CCA to instantiate containers as independent Container Realms, ensuring data confidentiality and integrity. Fasco employs a dedicated System Realm for system services and resource management, using exception forwarding and shared buffers to maintain isolation between container realms. Evaluation on ARMv8 hardware demonstrates that Fasco reduces startup latency and performance overhead compared to microVM-based confidential containers, while maintaining a small trusted computing base (TCB).
ARM CCA's hardware-enforced isolation slashes confidential container startup latency and overhead, making them practical for short-lived workloads.
The rapid advancement of cloud-native technologies has created an urgent need for security. Currently, confidential containers are increasingly deployed in multi-tenant environments. Existing confidential container designs mainly adopt a microVM-based architecture. Although this approach improves inter-container isolation, its complex software stack leads to high startup latency and significant resource overhead, making it unsuitable for short-lived container workloads. In this paper, we propose Fasco, a lightweight confidential container runtime based on the ARM Confidential Compute Architecture (CCA). Fasco directly instantiates each container as an independent Container Realm, leveraging CCA's hardware-enforced isolation to ensure the confidentiality and integrity of application data inside the container. In addition, Fasco introduces a dedicated System Realm to provide system services and resource management for container realms. Through exception forwarding and shared buffers, Fasco ensures isolation among different container realms. We have implemented a prototype of Fasco and evaluated its performance on ARMv8 hardware. Experimental results show that Fasco reduces the startup latency and performance overhead of existing confidential container architectures while maintaining a small TCB.
